How to Pass the Amazon Web Services SOA-C01 Exam: Comprehensive AWS Certified SysOps Administrator - Associate Guide and Tips

A Glacier data retrieval policy.

A Glacier Vault access policy.

A Glacier vault lock policy.

A Glacier vault notification

AWS Certificate Manager

AWS CloudHSM

AWS KMS

AWS Secrets Manager

Create a new CMK every 7 days to manually rotate the encryption keys.

Enable key rotation on the CMKs and set the rotation period 7 days.

Switch to using AWS CloudHSM as AWS KMS does not support key rotation.

Use data keys for each encryption task to avoid the need to rotate keys.

Create a cross-region dashboard using AWS Lambda and distribute it to all regions

Create a custom CloudWatch dashboard and add a widget for each region in the AWS Management

Console

Enable cross-region dashboards under the CloudWatch section of the AWS Management Console

Switch from basic monitoring to detailed monitoring on all instances

Attach a NAT gateway to the VPC and configure routing

Attach a virtual private gateway to the VPC and configure routing

Attach an internet gateway to the VPC and configure routing

Configure a VPN connection back to the corporate office.

Configure an Application Load Balancer in front of the EC2 instances

Create and run an Amazon Inspector assessment template.

Manually SSH into each instance and check the software version.

Use AWS CloudTrail to verify Amazon EC2 activity in the account.

Write a custom script and use AWS CodeDeploy to deploy to Amazon EC2 instances.

Configure an AWS Data Pipeline resource with a CopyActivity activity object. Specify the input and output bucket names and a list of object keys.

Configure the S3 bucket resource to activate cross-Region replication. Point to the existing S3 bucket and specify a list of object keys to replicate.

Create an AWS Lambda function that can perform the copy operation. Add the Lambda function to the template as a custom resource.

Specify the commands to copy the objects in the user data field of the template's S3 bucket resource.

Implement a blue/green strategy using AWS Elastic Beanstalk.

Perform a canary deployment using Application Load Balancers and target groups.

Create a change set for the running stack.

Submit the update using the UpdateStack API call.

Share the monthly AWS bill with management.

Use AWS CloudTrail Logs to access daily costs in JSON format.

Set up daily Cost and Usage Report and download the output from Amazon S3.

Monitor AWS costs with Amazon Cloud Watch and create billing alerts and notifications.

Enable AWS Trusted Advisor and show the Security team that the Security Groups unrestricted access check will alarm.

Schedule an AWS Lambda function to run hourly to scan and evaluate all security groups, and send a report to the Security team.

Use AWS Config to enable the restricted-common-ports rule, and add port 80 to the parameters.

Use Amazon Inspector to evaluate the security groups during scans, and send the completed reports to the Security team.